An EDR console shows a process tree: winword.exe → cmd.exe → powershell.exe -enc [base64 string] → net.exe user /add backdoor P@ssw0rd. Which MITRE ATT&CK techniques are represented, and what immediate action should be taken?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the process chain — Word spawning cmd spawning encoded PowerShell creating a local user — is a textbook malicious macro attack chain mapping to multiple ATT&CK techniques. Isolation prevents lateral movement; process termination stops execution; account audit determines if the backdoor succeeded.
Full explanation below image
![Portrait educational infographic teaching: An EDR console shows a process tree: winword.exe → cmd.exe → powershell.exe -enc [base64 string] → net.exe user /add backdoor P@ssw0rd. Which MITRE ATT&CK techniques are represente. Show labeled components, decision flow, and the key distinction that makes the correct answer correct. Clean modern diagram style.](/media/giac/gced/GCED-q081-infographic.webp)
Full Explanation
B is correct because the process chain — Word spawning cmd spawning encoded PowerShell creating a local user — is a textbook malicious macro attack chain mapping to multiple ATT&CK techniques. Isolation prevents lateral movement; process termination stops execution; account audit determines if the backdoor succeeded. A is wrong because legitimate software installation does not originate from Word documents spawning encoded PowerShell. C is wrong because failing to address the account creation leaves a persistent backdoor. D is wrong because this is a genuine malicious process chain, not a false positive.